Credential phishing emails are the clear favorite of threat actors, with a 478% spike last year, new research shows.